I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging.
Specifically, once this is enabled, are the default cmdlets logged? For example,
Get-Service and so on. Looking over the About_Group_Policy_Settings for PowerShell, a reference is given to the following Group Policy path
Computer Configuration\Administrative Templates\Windows Components\Windows PowerShell where Module Logging lists an example of enabling logging for Windows PowerShell Core modules by using
My question as it relates to InfoSec, has anyone looked into this from a defender's viewpoint? Specifically, does enabling Module logging increase the chance of exposing more attack surface and if so, are there any steps or best practices for hardening the logs and so on in an effort to mitigate the increased attack surface?
My guess would be replicate the Event Log for Windows PowerShell to a high security system or utilize encryption so that in the event an attacker discovered the Module Logging was enabled, the encryption would prevent the logs from being altered in an effort to cover the attackers tracks.